A client terminal connected to a network can download various content or applications by accessing a server on the network.
For example, software called “Java™ applet” described in Java™ programming language is designed to be downloaded to the client terminal from a source computer such as a server, and to be executed by a browser provided in the client terminal.
The Java™ applet is a small application with its size being made small so as to reduce the burden on the memory and on the CPU of the client terminal. When executing a process, the applet accesses a server on the network and executes the process in cooperation with the server.
However, an open network such as the Internet is generally not secure, and Java™ applets delivered through such a network are not always be trusted.
Thus, what is required is to preclude network access by an illegal Java™ applet, and, for this purpose, a system for controlling access has been proposed.
In the proposed system, a client terminal is able to access only a server of origin from which a Java™ applet program is downloaded. Specifically, a client terminal stores a host name of the origin server from which a Java™ applet program is downloaded together with identification information of the Java™ applet, and when the Java™ applet accesses the network, access to a server is prohibited if the accessed server does not have a host name that is the same as the one stored and which is correlated with the identification information. This access control method is commonly referred to as a “sand box.”
In addition to the Java™ applet mentioned above, there is another software which is described in Java™ programming language and referred to as a “Java™ application.” A Java™ application can be downloaded to a client terminal from a server or can be provided in a client terminal in advance, but when it is executed, the application operates in cooperation with software other than a browser, the software having been installed in the client terminal. However, access to the network made by Java™ applications is not an object of the above-mentioned sand box, and thus Java™ applications are able to interact with any server on the network.
A system for network resources adapted to Java™ is likely to be constructed more rapidly in the future, and given such a prospect, some kind of control over network access from Java™ applications needs to be provided.
However, an improper network access is still possible even when the above-mentioned sand box is used for limiting an access from a Java™ application to a server of origin from which the Java application has been downloaded. Specifically, since there are various functions performed by a server, an access might be made to a function of the server that is not intended by a user of a client terminal.
Thus, it is an object of the present invention to enhance security relating to network access by software such as Java™ applications.